How to Set Up a Production Ubuntu Server in 2026

Ubuntu's built-in firewall is simple and effective:

# Allow SSH (use your custom port if changed)
sudo ufw allow 2222/tcp

# Allow HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable

# Check status
sudo ufw status verbose

Output should show:

Status: active
To                         Action      From
--                         ------      ----
2222/tcp                   ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere

Everything else is blocked by default. If you need additional ports later (e.g., 8000 for an API), add them explicitly.

Security patches should be applied automatically:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Select "Yes" when prompted. Verify it's working:

cat /etc/apt/apt.conf.d/20auto-upgrades

Should contain:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

This automatically installs security updates daily. For more control, edit /etc/apt/apt.conf.d/50unattended-upgrades to configure email notifications and automatic reboots.

Fail2Ban blocks IP addresses that repeatedly fail authentication:

sudo apt install fail2ban

Create a local configuration:

sudo nano /etc/fail2ban/jail.local

Add:

[sshd]
enabled = true
port = 2222
filter = sshd
maxretry = 3
bantime = 3600
findtime = 600

This bans an IP for 1 hour after 3 failed SSH attempts within 10 minutes.

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Check banned IPs
sudo fail2ban-client status sshd

Install monitoring tools to catch problems early:

# System resource monitoring
sudo apt install htop iotop

# Disk usage alerts
sudo apt install logwatch

Create a simple disk space check script:

sudo nano /usr/local/bin/disk-check.sh

#!/bin/bash
USAGE=$(df / | tail -1 | awk '{print $5}' | sed 's/%//')
if [ $USAGE -gt 85 ]; then
    echo "WARNING: Disk usage is ${USAGE}%" | logger -t disk-check
fi

sudo chmod +x /usr/local/bin/disk-check.sh
# Run every hour
(crontab -l 2>/dev/null; echo "0 * * * * /usr/local/bin/disk-check.sh") | crontab -

Your server is now production-ready: non-root user, key-only SSH, firewall, automatic updates, brute-force protection, and basic monitoring.